When you create a Container Service for Kubernetes (ACK) managed cluster, you need to create only worker nodes. ACK creates and manages the control planes of the cluster. This reduces O&M costs and allows you to focus on business development. This topic describes how to create an ACK managed cluster in the ACK console.
Table of contents
For more information, see Billing.
When you create a Container Service for Kubernetes (ACK) cluster, take note of the following limits:
ACK clusters support only virtual private clouds (VPCs).
By default, each account has specific quotas on cloud resources that can be created. You cannot create clusters if the quota is reached. For more information about the quotas, see Quotas.
For more information, see Quotas.
By default, you can add up to 200 route entries to a VPC. This means that you can deploy up to 200 nodes in an ACK cluster that uses Flannel. This limit does not apply to ACK clusters that use Terway. To add more route entries to a VPC, apply for an increase on the quota of route entries in the VPC that you want to use.
By default, you can create at most 100 security groups with each account.
By default, you can create at most 60 pay-as-you-go SLB instances with each account.
By default, you can create at most 20 elastic IP addresses (EIPs) with each account.
Limits on Elastic Compute Service (ECS) instances:
The pay-as-you-go and subscription billing methods are supported.
After an ECS instance is created, you can change its billing method from pay-as-you-go to subscription in the ECS console. For more information, see Change the billing method of an ECS instance from pay-as-you-go to subscription.
Step 1: Log on to the ACK console
Log on to the ACK console and click Clusters in the left-side navigation pane.
In the upper-right corner of the Clusters page, click Create Kubernetes Cluster.
Step 2: Configure a cluster
On the Managed Kubernetes tab, configure the basic settings and advanced settings of the cluster.
Move the pointer over All Resources at the top of the page and select the resource group that you want to use. After you select a resource group, virtual private clouds (VPCs) and vSwitches that belong to the resource group are displayed. When you create a cluster, only the VPCs and vSwitches that belong to the selected resource group are displayed in the console.
Enter a name for the cluster.
Note The name must be 1 to 63 characters in length, and can contain digits, letters, hyphens (-), and underscores (_). The name cannot start with an underscore (_).
Select a cluster type. You can select Professional or Basic. We recommend that you use Container Service for Kubernetes (ACK) Pro clusters in the production environment and test environment. ACK basic clusters can meet the learning and testing needs of individual users.
Select a region to deploy the cluster.
Two billing methods are supported: Pay-As-You-Go and Subscription. If you select the subscription billing method, you must set the following parameters:
Note If you set Billing Method to Subscription, only Elastic Compute Service (ECS) instances and Server Load Balancer (SLB) instances are billed on a subscription basis. Other cloud resources are billed on a pay-as-you-go basis. For more information about the billing rules of Alibaba Cloud resources, see Billing of cloud services.
The Kubernetes versions supported by ACK are displayed.
Specify the container runtime based on the Kubernetes version.
If you enable IPv4/IPv6 dual-stack, a dual-stack cluster is created. This feature is in public preview. To use this feature, submit an application in Quota Center.
Select a VPC to deploy the cluster. Standard VPCs and shared VPCs are supported.
Note ACK clusters support only VPCs. You can select a VPC from the drop-down list. If no VPC is available, click Create VPC to create one. For more information, see Create and manage a VPC.
Select a network plug-in. Flannel and Terway are supported. For more information, see Terway and Flannel.
You can select up to three vSwitches that are deployed in different zones. If no vSwitch is available, click Create vSwitch to create one. For more information, see Create and manage a vSwitch.
If you select Terway as the network plug-in, you must select vSwitches to allocate IP addresses to pods. For each vSwitch that allocates IP addresses to worker nodes, you must select a vSwitch in the same zone to allocate IP addresses to pods.
Pod CIDR Block
If you select Flannel, you must set Pod CIDR Block.
The pod CIDR block must not overlap with the CIDR block of the VPC, the CIDR blocks of the ACK clusters in the VPC, or the Service CIDR block. The pod CIDR block cannot be modified after it is specified. For more information about how to plan CIDR blocks for an ACK cluster, see Plan CIDR blocks for an ACK cluster.
Number of Pods per Node
If you set Network Plug-in to Flannel, you must set Number of Pods per Node.
Set Service CIDR. The Service CIDR block must not overlap with the CIDR block of the VPC, the CIDR blocks of the ACK clusters in the VPC, or the pod CIDR block. The Service CIDR block cannot be modified after it is specified. For more information about how to plan CIDR blocks for an ACK cluster, see Plan CIDR blocks for an ACK cluster.
IPv6 Service CIDR
If you enable IPv4/IPv6 dual stack, you must specify an IPv6 CIDR block for Services. When you set this parameter, take note of the following items:
By default, an ACK cluster cannot access the Internet. If the VPC that you select for the cluster cannot access the Internet, you can select Configure SNAT for VPC. This way, ACK will create a NAT gateway and configure SNAT rules to enable Internet access for the VPC.
Access to API Server
By default, an internal-facing SLB instance is created for the Kubernetes API server of the cluster. You can modify the specification of the SLB instance. For more information, see Instance specifications.
Important If you delete the SLB instance, you cannot access the API server of the cluster.
Select or clear Expose API Server with EIP. The ACK API server provides multiple HTTP-based RESTful APIs, which can be used to create, delete, modify, query, and monitor resources, such as pods and Services.
You can select Create Basic Security Group, Create Advanced Security Group, or Select Existing Security Group. For more information about security groups, see Overview.
Specify whether to enable deletion protection for the cluster. Deletion protection can prevent clusters from being accidentally released by using the console or API.
The resource group that owns the cluster to be created. Each resource can belong only to one resource group. You can regard a resource group as a project, an application, or an organization based on your business scenarios. For more information, see Resource groups.
Click Show Advanced Options to configure advanced settings.
Select a time zone for the cluster. By default, the time zone of your browser is selected.
iptables and IPVS are supported.
Add labels to nodes in the cluster. Enter a key and a value, and then click Add.
Set the domain name of the cluster.
Note The default domain name is cluster.local. You can enter a custom domain name. A domain name consists of two parts. Each part must be 1 to 63 characters in length and can contain only letters and digits. You cannot leave these parts empty.
Custom Certificate SANs
You can enter custom subject alternative names (SANs) for the API server certificate of the cluster to accept requests from specified IP addresses or domain names.
For more information, see Customize the SAN of the API server certificate when you create an ACK cluster.
Service Account Token Volume Projection
ACK provides service account token volume projection to reduce security risks when pods use service accounts to access the Kubernetes API server. This feature enables kubelet to request and store the token on behalf of a pod. This feature also allows you to configure token properties, such as the audience and validity period. For more information, see Enable service account token volume projection.
If you select Select Key, you can use a key that is created in the Key Management Service (KMS) console to encrypt Kubernetes Secrets. For more information, see Use KMS to encrypt Kubernetes Secrets.
Step 3: Configure the node pool
Click Next:Node Pool Configurations to configure the basic settings and advanced settings of the node pool.
Click Show Advanced Options to configure advanced settings.
Node Pool Name
Managed Node Pool
Specify whether to enable the managed node pool feature. Managed node pools provided by ACK support auto repair and auto CVE patching. These capabilities reduce your O&M workload and improve node security. For more information, see Overview of managed node pools.
Image updates, runtime updates, and Kubernetes version updates are automatically performed during the maintenance window. For more information, see Overview of managed node pools.
Note The Maintenance Window parameter is available only for managed node pools.
Click Set. In the Maintenance Window dialog box, set the Cycle, Started At, and Duration parameters.
You can select multiple instance types. You can filter instance types by vCPU, memory, architecture, or category.
When the node pool is scaled out, ECS instances of the instance types that you select for the Instance Type parameter are created. The scaling policy of the node pool determines which instance types are used to create new nodes during scale-out activities. Select multiple instance types to improve the success rate of node pool scale-out operations.
The instance types that you select are displayed in the Selected Types section.
If the node pool fails to be scaled out because the instance types are unavailable or the instances are out of stock, you can specify more instance types for the node pool. The ACK console automatically evaluates the scalability of the node pool. You can view the scalability level when you create the node pool or after you create the node pool.
Note ARM-based ECS instances support only images for ARM. For more information about ARM-based node pools, see Configure an ARM-based node pool.
The selected instance types are displayed.
Specify the number of worker nodes (ECS instances) to be created.
We recommend that you configure at least two worker nodes. After the cluster is created, you can adjust the number of worker nodes to meet your business requirements. If the cluster has only one worker node or contains low-specification worker nodes, cluster components may not run as expected.
Enhanced SSDs (ESSDs), standard SSDs, and ultra disks are supported. The types of system disks that you can select depend on the instance types that you select. For more information about the disk types supported by different instance types, see Overview of instance families. Disk types that are not displayed in the drop-down list are not supported by the instance types that you select.
Mount Data Disk
ESSDs, standard SSDs, and ultra disks are supported. The disk types that you can select depend on the instance types that you select. For more information about the disk types supported by different instance types, see Overview of instance families. Disk types that are not displayed in the drop-down list are not supported by the instance types that you select.
ACK supports images for the following operating systems:
Note You cannot change the settings of the Security Reinforcement parameter after the cluster is created.
Valid values: Key Pair, Password, and Later.
Note If you select Reinforcement based on classified protection for the Security Reinforcement parameter, only the Key Pair option is supported.
Public IP Address
Specify whether to allocate an IPv4 address to each node. If you clear the check box, no public IP address is allocated. If you select the check box, you must also set the Bandwidth Billing Method and Peak Bandwidth parameters.
Note This parameter takes effect only on newly added nodes and does not take effect on existing nodes. If you want to enable an existing node to access the Internet, you must create an elastic IP address (EIP) and associate the EIP with the node. For more information, see Associate an EIP with an ECS instance.
Specify whether to install the CloudMonitor agent. After you install the CloudMonitor agent on ECS nodes, you can view the monitoring information about the nodes in the CloudMonitor console.
Specify whether to enable node protection.
Note By default, this check box is selected. Node protection prevents nodes from being accidentally deleted in the console or by calling the API.
Add labels to the ECS instances that are automatically added during auto scaling. Label keys must be unique. A key cannot exceed 128 characters in length. Keys and values cannot start with
An ECS instance can have at most 20 labels. The following labels are automatically added to an ECS node by ACK and Auto Scaling. Therefore, you can add 17 labels to an ECS node.
After you enable auto scaling, the following labels are added to the node pool by default:
The auto scaling component simulates scale-out activities based on node labels and taints. For this purpose, the format of each node label is changed to
Add taints to nodes. A taint consists of a key, a value, and an effect. A taint key can be prefixed. If you want to specify a prefixed taint key, add a forward slash (/) between the prefix and the remaining content of the key. For more information, see Taints and tolerations. The following limits apply to taints:
Add labels to nodes. A label is a key-value pair. A label key can be prefixed. If you want to specify a prefixed label key, add a forward slash (/) between the prefix and the remaining content of the key. The following limits apply to labels:
Expansion and Contraction Strategy
Important You cannot change the scaling policy of a node pool after the node pool is created.
Specify the CPU management policy for the kubelet on nodes in the node pool.
For more information, see CPU management policies.
Click Select RDS Instance to add node IP addresses to the whitelist of an ApsaraDB RDS instance.
Custom Node Name
Specify whether to use a custom node name. If you choose to use a custom node name, the name of the node, name of the ECS instance, and hostname of the ECS instance are changed.
A custom node name consists of a prefix, an IP address, and a suffix.
For example, the node IP address is 192.1xx.x.xx, the prefix is aliyun.com, and the suffix is test.
For more information, see Overview of ECS instance user data.
Step 4: Configure cluster components
Click Next:Component Configurations to configure the basic settings and advanced settings of cluster components.
Specify whether to install an Ingress controller. By default, Nginx Ingress is selected. Valid values:
Specify whether to install NodeLocal DNSCache. By default, NodeLocal DNSCache is installed.
NodeLocal DNSCache runs a Domain Name System (DNS) caching agent to improve the performance and stability of DNS resolution. For more information about NodeLocal DNSCache, see Configure NodeLocal DNSCache.
By default, CSI is installed as the volume plug-in. Dynamically Provision Volumes by Using Default NAS File Systems and CNFS, Enable NAS Recycle Bin, and Support Fast Data Restore is selected by default . ACK clusters can be automatically bound to Alibaba Cloud disks, Apsara File Storage NAS (NAS) file systems, and Object Storage Service (OSS) buckets that are mounted to pods. For more information, see Storage management - CSI.
Enable Prometheus Monitoring is selected by default to monitor ACK clusters and generate alerts.
Use Default Alert Rule Template is selected by default to enable alert rules. After you select this check box, you can specify contacts and contact groups. The default is Default Contact Group. For more information, see Alert management.
Specify whether to enable Log Service. You can select an existing Log Service project or create one. By default, Enable Log Service is selected. When you create an application, you can enable Log Service with a few steps. For more information, see Collect log data from containers by using Log Service.
By default, Create Ingress Dashboard is selected. You can specify whether to create Ingress dashboards in the Log Service console. For more information, see Analyze and monitor the access log of nginx-ingress.
By default, Install node-problem-detector and Create Event Center is selected. You can specify whether to enable the Kubernetes event center in the Log Service console. For more information, see Create and use an event center.
Log Collection for Control Plane Components
By default, Enable is selected to collect the logs of the control plane components in ACK managed clusters to your projects in Log Service. For more information, see Collect the logs of control plane components in ACK Pro clusters.
Specify whether to enable Alibaba Cloud Genomics Service (AGS).
Note To use this feature, submit a ticket to apply to be added to a whitelist.
Specify whether to enable the cluster inspection feature for intelligent O&M. You can enable this feature to periodically check the resource quotas, resource usage, and component versions of a cluster and identify potential risks in the cluster. For more information, see Work with the cluster inspection feature.
Click Show Advanced Options to select the components that you want to install.
Step 5: Confirm the cluster configurations
Click Next:Confirm Order. Confirm the cluster configurations, read the terms of service, and then select terms of service. Then, click Create Cluster.
It requires about 10 minutes to create an ACK cluster that contains multiple nodes.
What to do next
After the cluster is created, you can view the cluster on the Clusters page in the ACK console.
Click View Logs in the Actions column. On the Log Information page, you can view the cluster log. To view detailed log information, click Stack events.
On the Clusters page, find the created cluster and click Details in the Actions column. On the cluster details page, click the Basic Information tab to view the basic information about the cluster and click the Connection Information tab to view information about how to connect to the cluster.
The following information is displayed:
API Server Public Endpoint: the IP address and port that the Kubernetes API server of the cluster uses to provide services over the Internet. It allows you to manage the cluster by using kubectl or other tools on your client.
Associate EIP and Disassociate EIP: These options are available only for ACK managed clusters.
Associate EIP: You can select an existing elastic IP address (EIP) or create one.
The API server restarts after you bind an EIP to the API server. We recommend that you do not perform operations on the cluster during the restart process.
Disassociate EIP: You cannot access the API server over the Internet after you unbind the EIP from the API server.
The API server restarts after you unbind the EIP from the API server. We recommend that you do not perform operations on the cluster during the restart process.
API Server Internal Endpoint: the IP address and port that the API server uses to provide services within the cluster. The IP address belongs to the Server Load Balancer (SLB) instance that is attached to the cluster.
Testing Domain: the domain name that is used for service tests. The suffix of the domain name is
To rebind the domain name, click Rebind Domain Name.
You can use kubectl to connect to the cluster and run the
kubectl get nodecommand to query information about the nodes in the cluster. For more information, see Obtain the kubeconfig file of a cluster and use kubectl to connect to the cluster.